3f70da063d48c6a6921fee36436a7ca0078c499746c43c575d17476c7aeb19e3

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19-05-2024 19:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

locales/en-GB.pak
Size

389KB
MD5

745918a5a74c7b6f4818a8bb8813f456
SHA1

031f50286d003844425ddac557e13e2ea4554bc2
SHA256

91bdbf5f1f6bcbcaf16e47865f72ec97d72c74174fb929f089d14c00989f91f4
SHA512

5a1eb0231352705bab527ab27543612d75cb00c522620828ce2a0fdb0b47be9daa2dd7a192f8b4bf299007c5af1d9515f900b9586ba44dd2bd9f4cd4436aa681
SSDEEP

6144:bY/F2I4WPMdRwa/YBNSxMP9eFESofaYvskuN5jVS6B7RuKv:btpswRxMSESau5RSuv

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pak\ = "pak_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pak_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pak_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pak_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pak_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pak_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pak	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2220	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2220	AcroRd32.exe
2220	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2692	2908	cmd.exe	29
PID 2908 wrote to memory of 2692	2908	cmd.exe	29
PID 2908 wrote to memory of 2692	2908	cmd.exe	29
PID 2692 wrote to memory of 2220	2692	rundll32.exe	30
PID 2692 wrote to memory of 2220	2692	rundll32.exe	30
PID 2692 wrote to memory of 2220	2692	rundll32.exe	30
PID 2692 wrote to memory of 2220	2692	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\en-GB.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\en-GB.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\en-GB.pak"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
39db23e30c8d9096c64897311283481b

SHA1
9a13e8c4da8f44399907fdfab38f6e03785aeee5

SHA256
b465426d48f5b494e20502fe224573f15fc60954fce5239e63f71464450badb7

SHA512
4ad1fab1d4f6543d326fe7e0920c95bdd91f7fd158ed351c322e9f90d26471451d00fb503c4a00a943deec7f6cdac86d28b361c4f24ec99eb8466030d58cd476

Download Submit